From bc0c0b103fe183d948816f722efec606452ca401 Mon Sep 17 00:00:00 2001
From: kolaente <k@knt.li>
Date: Fri, 24 Jan 2025 10:09:36 +0100
Subject: [PATCH] feat: validate expand api parameter

---
 pkg/models/error.go           |  6 +++++-
 pkg/models/task_collection.go | 15 +++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/pkg/models/error.go b/pkg/models/error.go
index 685c748cb..4332ed095 100644
--- a/pkg/models/error.go
+++ b/pkg/models/error.go
@@ -111,11 +111,15 @@ func (err ValidationHTTPError) Error() string {
 }
 
 func InvalidFieldError(fields []string) error {
+	return InvalidFieldErrorWithMessage(fields, "Invalid Data")
+}
+
+func InvalidFieldErrorWithMessage(fields []string, message string) error {
 	return ValidationHTTPError{
 		HTTPError: web.HTTPError{
 			HTTPCode: http.StatusPreconditionFailed,
 			Code:     ErrCodeInvalidData,
-			Message:  "Invalid Data",
+			Message:  message,
 		},
 		InvalidFields: fields,
 	}
diff --git a/pkg/models/task_collection.go b/pkg/models/task_collection.go
index 397c6e682..a61084a2a 100644
--- a/pkg/models/task_collection.go
+++ b/pkg/models/task_collection.go
@@ -64,6 +64,16 @@ type TaskCollectionExpandable string
 
 const TaskCollectionExpandSubtasks TaskCollectionExpandable = `subtasks`
 
+// Validate validates if the TaskCollectionExpandable value is valid.
+func (t TaskCollectionExpandable) Validate() error {
+	switch t {
+	case TaskCollectionExpandSubtasks:
+		return nil
+	}
+
+	return InvalidFieldErrorWithMessage([]string{"expand"}, "Expand must be one of the following values: subtasks")
+}
+
 func validateTaskField(fieldName string) error {
 	switch fieldName {
 	case
@@ -331,6 +341,11 @@ func (tf *TaskCollection) ReadAll(s *xorm.Session, a web.Auth, search string, pa
 		return nil, 0, 0, err
 	}
 
+	err = tf.Expand.Validate()
+	if err != nil {
+		return nil, 0, 0, err
+	}
+
 	opts.search = search
 	opts.page = page
 	opts.perPage = perPage